France accused Iran’s Revolutionary Guards on Monday of hacking supermarket refrigerators and freezers, turning up the heat remotely and forcing stores to dump spoiled food. France’s cybersecurity agency said at least 15 fires broke out after the attackers changed settings on refrigeration equipment.
The attacks struck overnight on Oct. 11–12 and targeted refrigeration controls at about 700 retail sites, according to the cybersecurity agency, known as ANSSI. The French Foreign Ministry estimated food losses in the tens of millions of euros. At some stores, temperatures hit 122 degrees Fahrenheit (50 degrees Celsius) for about six hours, The Associated Press reported.
“This is an attack of unprecedented scale and aggressiveness,” French Foreign Minister Jean-Noël Barrot said on the sidelines of Group of Seven talks in Paris. His ministry called the operation France’s first cyber campaign carried out solely to sabotage targets on its soil.
Barrot said France had summoned Iran’s ambassador. The ministry said Paris would propose new European Union sanctions against Iranian individuals and entities implicated in the attacks and reserved the right to take further measures. Iran’s mission to the United Nations did not respond to Reuters’ requests for comment.
French Investigators Name an Iranian Cyber Unit
French investigators attributed the October operation to Shahid Kaveh, an offensive cyber unit affiliated with the Islamic Revolutionary Guard Corps. They cited the tools used, the infrastructure behind the attack and traces of Farsi in that infrastructure. Investigators also said a propaganda outlet linked to the unit publicized the attack. The Foreign Ministry called Shahid Kaveh “a persistent threat to our critical infrastructure,” in a statement translated from French.
The attackers changed the defrost settings on compromised equipment, ANSSI said. Investigators identified other victims in the food industry, including small butcher shops, a slaughterhouse and food-processing plants. The agency also linked the operation to attacks on equipment at small French hydroelectric facilities, where it said the impact was limited.
ALSO READ: Anthropic Pulls IPO Pricing Behind US$69.3 Billion Estimate
Paris prosecutor Laure Beccuau said a judicial investigation was targeting the unit’s leader, his two deputies and others who might be identified. Investigators found internet addresses linked to devices in Iran, she said. The prosecutor’s office requested international arrest warrants for several members of the group.
French officials linked a separate Revolutionary Guard cyber unit, Shahid Shoostari, to earlier operations targeting the satirical newspaper Charlie Hebdo in 2023 and a French video-display company ahead of the 2024 Paris Olympics. ANSSI said investigators discovered the breach at the display company before the attackers could use its screens to show images protesting Israeli athletes’ participation.
More Refrigeration Attacks Across Europe
A second wave in November hit more than 100 establishments across Europe, Reuters reported. Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia experienced refrigeration failures, according to AP. French blood banks were also targeted. Staff moved some blood to other storage units, Reuters reported. AP said the attack was stopped before it damaged blood products or samples. French officials’ public attribution focused on the October operation.
U.S. investigators are examining similar failures at military grocery stores. Refrigerators at six or more commissaries went down in August. Pentagon investigators are treating the failures as a possible cyberattack and working with French officials, Reuters reported. A person familiar with the inquiry told Reuters that the military considers Iran a suspect. The Pentagon said it was “aware of speculation regarding a potential cyber incident” and cited security concerns in declining to elaborate. Reuters could not independently establish a link between the U.S. failures and the attacks in Europe.
A supplier behind many of the affected refrigeration units told Reuters that several were obsolete or ran outdated firmware. Cybersecurity specialists told Reuters that the attacks appeared relatively easy to carry out.